CriticalSecurity
Tenant filter missing on export query
api/handlers/export.go:88
The new export endpoint queries invoices by id only. Every other handler in this package scopes by org_id; this one returns another tenant's data when ids are guessed.
AI code review for engineering organizations
Code review that understands your whole codebase
MergeHarbor reviews every pull request with the context of all your repositories, verifies each finding before it is posted, and learns your team's standards. It runs in our cloud or yours, with SSO, audit logs, and predictable cost per review.
- No credit card required
- Self-hosting available
- Code never used for training
Works with the code hosts you already run — in the cloud or self-managed
GitHub
Cloud · Enterprise Server
GitLab
Cloud · Self-Managed
Bitbucket
Cloud · Data Center
Gitea
Self-hosted · Forgejo
The console
See what needs attention across every repository
Critical findings, pull requests waiting on a fix, indexing progress, and spend against budget — in one place for every team.
How it works
A reviewer that does the investigation first
Diff-only tools comment on the lines that changed. MergeHarbor follows the change through the codebase, then checks its own work.
- 01
Index the codebase
MergeHarbor builds a graph of every repository — files, symbols, and call relationships — plus a semantic index, and keeps both current with each push.
- 02
Investigate the pull request
An agent reads the change, follows callers and callees across the codebase, searches for similar code, and checks history before it forms an opinion.
- 03
Verify before posting
Every finding goes through an independent verification pass that tries to disprove it. Only findings that survive are posted, with a confidence score.
- 04
Learn your standards
Rules written in plain English, your existing CLAUDE.md and AGENTS.md files, and the team's reactions to comments shape every later review.
What it catches
The bugs that only show up when you read beyond the diff
Cross-file logic errors, missing authorization, races, and data-integrity problems — reported with the evidence that led to them.
MajorConcurrency
Lock released before the shared map is updated
worker/pool.py:141
drain() releases _lock and then writes to _inflight. Two workers draining at once can drop a job. The callers in scheduler.py run drain() concurrently.
MajorData integrity
Balance update runs outside the transaction
billing/ledger.ts:212
updateBalance() is called after tx.commit(). If it fails, the ledger entry exists without the balance change; the retry in capture() then double-credits.
Illustrative findings in the format MergeHarbor posts on pull requests.
Your standards
Reviews that follow your rules, not generic advice
Set strictness, categories, and filters for the organization, override them per repository, and keep repository-specific rules in version control.
Plain-English rules. Teach a rule from the console or in a pull request with
@mergeharbor remember, scoped to the paths it applies to.Context you already wrote. CLAUDE.md, AGENTS.md, Cursor rules, and a knowledge base of design documents are read on every review.
Learning with approval. Patterns in your team's reactions become proposed rules that an admin approves before they take effect.
Tamper-proof configuration.
.mergeharbor.ymlis read from the merge base, so a pull request cannot change how it is reviewed.
In your workflow
Feedback where your engineers already work
MergeHarbor posts on the pull request and gets out of the way. No new tool to check, no extra step to merge.
Inline comments with fixes
Findings land on the exact lines, with a suggested change you can commit from the code host and a ready-to-paste prompt for Claude Code,
Cursor, or other coding agents.
Status checks and auto-approve
Gate merges on a minimum confidence score or on critical findings, and optionally approve pull requests that come back clean.
Summaries reviewers can trust
Each review opens with a summary of the change, a confidence score, and an optional sequence diagram of the new flow.
Commands in the conversation
Ask for a re-review with
@mergeharbor review, or teach a rule without leaving the pull request.
Incremental on every push
New commits are reviewed on their own, earlier findings carry forward, and findings you fixed are marked addressed.
Analytics for engineering leaders
Bugs caught by severity, time to merge, addressed rate, and comment ratings, by team, repository, and author.
Predictable cost
The right model for each pull request
A documentation change does not need the most expensive model. A change to payments code does. MergeHarbor decides per pull request, and shows you the bill.
- Routing by size, complexity, criticality, and repository history, with a quality floor for high-risk changes
- Monthly budgets per organization that warn or pause before you overspend
- Cost per review, per pull request, and per developer, visible to admins
Built for enterprises
Security your review board will sign off on
Run MergeHarbor in your own cloud, connect it to your identity provider, and keep a tamper-evident record of every action.
Self-hosted or cloud
Deploy on Kubernetes with our Helm chart, or on AWS with Terraform. Use your own model accounts so code stays in your cloud.
SSO and fine-grained roles
OIDC single sign-on with enforcement, domain allowlists, group-to-role mapping, and custom roles.
Tamper-evident audit log
Every change, login, and export is recorded in an append-only, hash-chained log you can verify and stream to your SIEM.
Secrets never reach a model
Keys, tokens, and credentials are stripped from code before any model, log, or archive sees them.
Isolation by design
Every request is scoped to its organization; data from one organization is never visible to another.
Data residency
Choose where inference runs, set retention per organization, and keep customer code out of model training.
Design partner program
Shape MergeHarbor with us
We work closely with a small group of engineering organizations on deployment, review quality, and the roadmap. Partners get direct access to the engineers building MergeHarbor and preferred pricing.
Frequently asked questions
How is MergeHarbor different from a linter or a diff-based AI reviewer?+
Linters check rules on individual files, and most AI reviewers only see the lines that changed. MergeHarbor indexes your repositories as a graph of files, symbols, and calls, so the reviewer can trace a change to its callers, compare it with similar code, and read history before reporting. Each finding then passes an independent verification step before it is posted.
Which code hosts are supported?+
GitHub, GitHub Enterprise Server, GitLab (including self-managed), Bitbucket Cloud, Bitbucket Data Center, Azure DevOps Services, Azure DevOps Server (2020 and later), and Gitea or Forgejo. Self-managed hosts on private networks are supported when MergeHarbor is self-hosted or can reach them.
Which languages does MergeHarbor understand?+
Symbol-level indexing covers Go, Python, JavaScript, TypeScript, Java, Rust, Ruby, C#, C, and C++. Other languages are indexed for search and reviewed with the same agent, with less structural context.
Is our code used to train models?+
No. Customer code is never used for training, secrets are removed before content reaches a model, and you can choose where inference runs or bring your own model provider accounts.
Can we self-host MergeHarbor?+
Yes. MergeHarbor ships as container images with a Helm chart for Kubernetes and Terraform for AWS. Self-hosted deployments support SSO, audit export, and your own model provider accounts.
How long does setup take?+
Connecting a code host and choosing repositories takes a few minutes. Reviews start immediately; indexing runs in the background and adds codebase context as it completes.
Have another question? Talk to our team
Review every pull request with the context of your whole codebase
Connect a code host in minutes. Reviews start before indexing finishes.